A computer network configuration formal verification method and system

Abstract

The present invention relates to the technical field of computer network configuration verification, specifically a method and system for formal verification of computer network configuration, which starts from the attribute to be verified, traverses the configuration syntax analysis tree multiple times according to the dependency relationship between configuration instructions, and then extracts the configuration instructions related to the attribute to be verified. After obtaining the relevant configuration, a suitable control plane verification tool can be selected to analyze whether the attribute to be verified is established. The present invention can significantly improve the scalability of existing control plane verification tools by calculating the configuration instructions related to the attribute to be verified and reducing the scale of the network to be analyzed, such as significantly reducing the verification time and significantly reducing memory consumption, so that the verification tool can be applied to the analysis of large-scale complex networks in the real world; due to the use of customized configuration instruction dependencies, it is easy to modify the dependencies to adapt to new network characteristics, new configuration formats and new configuration semantics.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network configuration verification, and in particular to a computer network configuration formal verification method and system. Background Art

[0002] With the continuous emergence of services such as big data, 5G mobile communications, and VR / AR, communication networks are experiencing exponential growth in scale and complexity. This makes network configuration extremely difficult and prone to errors, leading to network failures. Furthermore, current fault diagnosis still relies on human experience, resulting in a series of problems such as long-lasting faults, wide-ranging impacts, and unpredictable risks. These problems can even lead to serious network incidents such as nationwide network outages and severe degradation of service quality.

[0003] In recent years, large-scale network incidents have occurred frequently, causing serious social and economic impacts. In June 2019, Google Cloud experienced a network outage due to an unexpected control plane failure, severely impacting hosting services in the western, eastern, and central United States for over four hours. In October 2021, a configuration error in Facebook's backbone network rendered its related internet services inaccessible for six hours. In July 2022, Japanese operator KDDI caused a nationwide communication outage lasting over 60 hours while updating its core router configuration. Furthermore, statistics show that network configuration errors account for as much as 56% of network failures, making them a significant contributing factor to the frequent occurrence of network incidents.

[0004] In order to pre-verify the correctness of the network before configuration and deployment, researchers proposed a control plane verification method to analyze network behavior. This method first reads network configuration files, topology, and external routing announcements, and then establishes different models (such as static analysis, simulation, emulation, graphs, and SMT network models) to discover network faults and verify network correctness, providing new ideas for ensuring the correct operation of the network.

[0005] In recent years, representative methods for control plane verification include:

[0006] Technical Solution 1: In the publicly published paper titled "A General Approach to Network Configuration Analysis," the authors proposed Batfish, which faithfully simulates the protocol execution process to generate a high-fidelity data plane. It then verifies whether the policy is valid on the generated data plane. If it is not valid, it generates specific counterexample groups and locates the corresponding configuration.

[0007] Technical Solution 2: In the publicly available paper titled "A General Approach to Network Configuration Verification," the authors proposed Minesweeper. This method verifies the validity of properties by encoding the network configuration, topology, and properties to be verified as SMT constraints, namely, F = N∧¬P. This constraint is then solved using an SMT solver. N represents the routing information exchange of the control plane and packet forwarding of the data plane implied by the network configuration, and P represents the property to be verified. If F is unsatisfiable, property P holds true in all network environments. Otherwise, it fails under specific conditions, such as certain link failures. Administrators can use feasible solutions to F to derive specific counterexamples and fix the corresponding configuration vulnerabilities.

[0008] Technical Solution 3: In a publicly published paper titled "Control Plane Compression," the authors proposed Bonsai. By designing a control plane compression algorithm, it compresses a large, specific network into a small, abstract network with similar control plane behavior. This ensures that the stable routing solution for the original network also exists in the compressed network, and vice versa. This allows administrators to analyze only the compressed network, accelerating network analysis.

[0009] The main problem with Solution 1 is that when verifying whether the attribute is valid under uncertain scenarios (such as link failure), all possible situations need to be enumerated, and therefore it cannot be extended to large-scale networks.

[0010] The main problem with Solution 2 is that as the network size increases, the number of variables and constraints created when encoding the control plane increases significantly, making it difficult for the SMT solver to search the massive solution space within a limited time (24 hours) and thus unable to be expanded to large-scale networks.

[0011] The main problems with Solution 3 are: its main application scenario is a highly symmetrical data center network, while the compression effect is not very obvious for a WAN topology that lacks symmetry; secondly, the compression algorithm causes the verification tool to lose the ability to verify certain attributes, such as link fault tolerance. Summary of the Invention

[0012] In order to overcome the defects of the above-mentioned prior art, the purpose of the present invention is to provide a method and system for formal verification of computer network configuration to solve the technical problems of existing control plane verification tools such as high scalability, long verification time and high memory consumption.

[0013] The present invention is achieved through the following technical solutions:

[0014] A method for formal verification of computer network configuration includes the following steps:

[0015] Step 1: Read the attributes to be verified, including the attribute type, source node, destination node, and link tolerance value, and use ANTLR to write a configuration grammar file that complies with the manufacturer's specifications to construct a configuration file grammar analysis tree;

[0016] Step 2: Taking the read attribute to be verified and the constructed parse tree as objects, traverse the parse tree multiple times according to the custom dependency relationship to obtain configuration instructions that affect the routing advertisement and packet forwarding behavior related to the attribute to be verified;

[0017] Step 3: Using the nodes of the obtained configuration instructions as the source node and the destination node, use the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attribute to be verified;

[0018] Step 4: Taking the obtained network nodes and links as objects, retrieve the configuration instructions related to the attribute to be verified according to the dependency relationship between the configuration instructions;

[0019] In step 5, the obtained network nodes, links, and configuration instructions are used as objects, and the nodes that will have no messages if any adjacent link fails are equivalently deleted, thus completing the formal verification of the computer network configuration.

[0020] Preferably, in step 1, the process of constructing the grammar analysis tree is to write a configuration grammar file, then use ANTLR to compile the grammar file to generate a program that can recognize a specific configuration format, and finally use the listener mode or visitor mode provided by ANTLR to traverse the grammar analysis tree corresponding to the configuration file.

[0021] Preferably, in step 2, during the process of traversing the syntax analysis tree, it is possible to retrieve whether the configuration instruction intersects with the attribute to be verified, and determine the object to be detected in the next iteration according to the behavior of the routing policy. The specific process is as follows:

[0022] Step 21: Initialize a queue based on the destination prefix of the attribute to be verified.

[0023] Step 22, traverse the syntax analysis tree according to the first element of the queue to retrieve the relevant configuration;

[0024] Step 23: Update the queue according to the configured routing policy, and stop traversing until the queue is empty.

[0025] Preferably, in step 2, the syntax analysis tree is traversed multiple times according to the custom dependency relationship, and a breadth-first search is used to obtain all configuration instructions that may affect the attribute to be verified.

[0026] Preferably, in step 2, ANTLR provides a listener pattern and a visitor pattern to implement traversal of the grammar analysis tree, wherein the listener pattern traverses the entire grammar analysis tree, while the visitor pattern can selectively traverse the grammar analysis tree according to the target to be retrieved.

[0027] Furthermore, the process of traversing the grammar analysis tree is as follows:

[0028] Parse the real prefix object from the context object of the syntax tree, then obtain the current target to be retrieved, that is, the first element in the queue, and determine whether the two intersect, that is, whether there is a dependency relationship. The form of the dependency relationship can be customized here, and finally record the relevant configuration information; the remaining nodes in the syntax tree can customize the dependency relationship and dependency form, so that all relevant configurations can be fully retrieved.

[0029] Preferably, in step 3, the specific process of using the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attribute to be verified is as follows:

[0030] First, initialize the link set allEdges to empty and calculate the relevant links between any two nodes. The upper bound of the link tolerance value when calculating the relevant links is the smaller of the user-specified max_failure+1 and the minimum cut between the two nodes. If the calculated minimum cut of the local network edge_graph does not reach the upper bound, the cut edge is deleted, the shortest path is recalculated, and it is added to the relevant link edges. Finally, all the relevant nodes and links are obtained.

[0031] Preferably, in step 4, configuration instructions related to the attribute to be verified are retrieved based on the dependency relationship between the configuration instructions, wherein the relevant interface configuration, protocol configuration and policy configuration are retrieved in sequence based on the calling relationship and potential dependency relationship within the configuration file, that is, the configuration irrelevant to the attribute to be verified is deleted.

[0032] Preferably, in step 5, the specific process of equivalently deleting nodes that will have no messages if any adjacent link fails, taking the obtained network nodes, links, and configuration instructions as objects, is as follows:

[0033] First, all nodes are traversed, excluding the source node and the destination node. If a node is a node where any adjacent link failure will result in no message, the node is deleted and the configuration of the adjacent nodes is updated.

[0034] A computer network configuration formal verification system, used for the above-mentioned computer network configuration formal verification method, comprises:

[0035] The data processing module is used to read the attributes to be verified, including the attribute type, source node, destination node, and link tolerance value, and use ANTLR to write a configuration grammar file that complies with the manufacturer's specifications to construct a configuration file grammar analysis tree;

[0036] A parse tree traversal module is used to take the read attributes to be verified and the constructed parse tree as objects, traverse the parse tree multiple times according to the custom dependency relationship, and obtain configuration instructions that affect the routing announcement and packet forwarding behavior related to the attributes to be verified;

[0037] A data calculation module is used to use the nodes of the obtained configuration instructions as source nodes and destination nodes, and use the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attribute to be verified;

[0038] A data retrieval module is used to retrieve configuration instructions related to the attribute to be verified based on the dependency relationship between the configuration instructions, taking the obtained network nodes and links as objects;

[0039] The data deletion module is used to take the obtained network nodes, links, and configuration instructions as objects, and to equivalently delete the nodes that will have no messages if any adjacent link fails, thereby completing the formal verification of the computer network configuration.

[0040] Compared with the prior art, the present invention has the following beneficial technical effects:

[0041] The present invention provides a method for formal verification of the configuration of a computer network. Starting from the attribute to be verified (such as reachability), the configuration syntax analysis tree is traversed multiple times according to the dependency relationship between the configuration instructions, and the configuration instructions related to the attribute to be verified are extracted. After obtaining the relevant configuration, a suitable control plane verification tool can be selected to analyze whether the attribute to be verified is established. By calculating the configuration instructions related to the attribute to be verified, the present invention reduces the scale of the network to be analyzed, and can significantly improve the scalability of existing control plane verification tools, such as significantly reducing verification time and significantly reducing memory consumption, so that the verification tool can be applied to the analysis of large-scale complex networks in the real world; because customized configuration instruction dependencies are used, it is easy to modify the dependencies to adapt to new network characteristics, new configuration formats, new configuration semantics, etc.

[0042] Furthermore, compared with some other optimization methods, such as Bonsai and BiNode, the present invention does not lose the verification capabilities of the verification tool (such as predicting whether the attributes are valid under certain link failure conditions), and does not limit the usage scenarios of the verification tool (such as network protocols and network topologies); by focusing on local configuration instructions and topological structures, we can better understand the role, importance and function of specific nodes in the network, and easily reveal the reasons for attribute violations.

[0043] Furthermore, continuously retrieving configuration instructions related to the attributes to be verified, and equivalently deleting irrelevant configurations, can greatly reduce the number of variables and constraints created, greatly reduce the scale of network analysis, and improve the scalability of the verification tool without losing the attribute verification capability of the verification tool, without limiting the application scenarios of the verification tool, and can select appropriate verification tools for verification as needed. For example, for the case of dense local network links, an SMT-based method can be used for verification to avoid enumerating all link state spaces; for the case of a large number of nodes, a simulation-based method can be used for verification to obtain higher verification fidelity. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 The present invention provides a flowchart of a method for formal verification of configuration of a computer network;

[0045] Figure 2 This is a schematic diagram of configuration dependencies in the present invention;

[0046] Figure 3 Retrieve relevant configuration diagrams in the present invention;

[0047] Figure 4 A schematic diagram of a local network for calculating a link failure model in the present invention;

[0048] Figure 5 This is a schematic diagram of equivalent node deletion in the present invention;

[0049] Figure 6 This is a schematic diagram of a network example in the present invention;

[0050] Figure 7 Schematic diagram of the grammatical analysis tree in the present invention;

[0051] Figure 8 This is a (simplified) schematic diagram of traversing interface nodes in the present invention. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0053] The present invention is described in further detail below with reference to the accompanying drawings:

[0054] The purpose of the present invention is to overcome the problems existing in the above-mentioned prior art and provide a local network analysis method based on custom configuration dependencies. The method can retrieve configuration instructions related to the attributes to be verified, thereby reducing the scale of network analysis and improving the scalability of the control plane verification tool without losing the attribute verification capability of the verification tool and without limiting the application scenarios of the verification tool.

[0055] Customized configuration dependencies can help identify configuration instructions that potentially affect route advertisements and packet forwarding, reducing the need to analyze irrelevant configurations. The following describes customized configuration dependencies.

[0056] There may be some dependencies between the configuration files of different devices. Figure 2 In the example shown, Router A advertises the prefix 10.1.0.1 / 24, Router B adds the community attribute 1:1 to this prefix, and Router C filters routes with the community attribute 1:1. Different devices may apply routing policies to the same route and modify route attributes, jointly influencing the transmission of a route or packet. Therefore, these configurations potentially have dependencies.

[0057] There may be some dependencies between different configuration instructions in the configuration file of the same device. Figure 2 As shown in the figure, Router B establishes a BGP neighbor relationship with the neighboring node. The IP address of the neighboring node and the IP address of interface GigabitEthernet0 / 0 / 0 are in the same subnet. That is, the configuration of the BGP process depends on the configuration of interface GigabitEthernet0 / 0 / 0. Router B configures the routing policy test to perform route filtering. That is, the BGP process configuration depends on the routing policy test configuration. The routing policy test uses a specific ip-prefix to filter routes with a specific prefix. That is, the configuration of the routing policy test depends on the configuration of a certain ip-prefix.

[0058] At the same time, for some unknown dependencies, the dependencies can be reasonably defined and modified according to the actual situation, thereby ensuring the integrity of the relevant configuration instructions retrieved. Customized dependencies implicitly capture all relevant configurations that may affect route advertisements and forwarding packets. Based on these dependencies, the present invention can discover all configurations related to the attribute to be verified, and then use appropriate control plane verification tools to complete the attribute verification, avoiding the need for comprehensive network analysis.

[0059] Specifically, according to Figure 1 As shown, the configuration formal verification method of the computer network includes the following steps:

[0060] Step 1: Read the attributes to be verified, including the attribute type, source node, destination node, and link tolerance value, and use ANTLR to write a configuration grammar file that complies with the manufacturer's specifications to construct a configuration file grammar analysis tree;

[0061] Specifically, the process of constructing the grammar analysis tree is to write a configuration grammar file, then use ANTLR to compile the grammar file to generate a program that can recognize a specific configuration format, and finally use the listener mode or visitor mode provided by ANTLR to traverse the grammar analysis tree corresponding to the configuration file.

[0062] Step 2: Taking the read attribute to be verified and the constructed parse tree as objects, traverse the parse tree multiple times according to the custom dependency relationship to obtain configuration instructions that affect the routing advertisement and packet forwarding behavior related to the attribute to be verified;

[0063] Specifically, according to Figure 3 As shown, during the traversal of the syntax analysis tree, it is possible to check whether the configuration instructions intersect with the attributes to be verified. The object to be checked in the next iteration is determined based on the behavior of the routing policy. The specific process is as follows:

[0064] Step 21, lines 3-4 initialize the queue based on the destination prefix of the attribute to be verified;

[0065] Step 22, traverse the parse tree (7 lines) according to the first element of the queue to retrieve the relevant configuration;

[0066] Step 23: Update the queue according to the configured routing policy, and stop traversing until the queue is empty.

[0067] Specifically, during the traversal of the syntax analysis tree, it is possible to detect whether the configuration instructions have an intersection (dependency) with the attributes to be verified. However, only one traversal cannot find all the relevant configurations. It is necessary to determine the objects to be detected in the next iteration based on the behavior of the routing policy. Figure 2 When router R3 advertises a BGP route, it adds the community attribute. At this point, the syntax tree must be traversed again to determine if a routing policy on a device matching this community attribute exists, specifically R2. Therefore, intuitively, this method uses breadth-first search (BFS) to find all relevant configurations that match the dependencies between configuration files.

[0068] Step 3: Using the nodes of the obtained configuration instructions as the source node and the destination node, use the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attribute to be verified;

[0069] Specifically, according to Figure 4The figure below describes the process of calculating relevant links. First, the link set allEdges is initialized to empty (line 1), and the relevant links between any two nodes are calculated (lines 2-3). The upper bound of the link tolerance when calculating relevant links is the smaller of the user-specified max_failure + 1 and the minimum cut between the two nodes (line 9). If the calculated minimum cut of the local network edge_graph does not meet the upper bound, the cut edge is deleted from the original graph (line 18), the shortest path is recalculated (line 19), and it is added to the relevant links edges. Finally, all relevant nodes and links are obtained (line 26).

[0070] Step 4: Taking the obtained network nodes and links as objects, retrieve the configuration instructions related to the attribute to be verified according to the dependency relationship between the configuration instructions;

[0071] Specifically, configuration instructions related to the attribute to be verified are retrieved based on the dependency relationship between configuration instructions. Among them, the relevant interface configuration, protocol configuration and policy configuration are retrieved in sequence based on the calling relationship and potential dependency relationship within the configuration file, that is, the configuration irrelevant to the attribute to be verified is deleted.

[0072] In step 5, the obtained network nodes, links, and configuration instructions are used as objects, and the nodes that will have no messages if any adjacent link fails are equivalently deleted, thus completing the formal verification of the computer network configuration.

[0073] Specifically, Figure 5 This section describes the specific process for deleting and updating node configurations. First, all nodes (excluding the source and destination nodes) in step 4 are traversed. If a node's degree is 2, it is deleted and the configurations of adjacent nodes are updated, such as reestablishing neighbor relationships and updating link costs (lines 6-14). Nodes with a degree of 1 are directly deleted (lines 15-17) without affecting the verification results. This process ensures that every node in the network has a degree greater than or equal to 3, making the network more compact and avoiding searching invalid link state space.

[0074] Example

[0075] according to Figure 6As shown in the figure, it is a simple network example. Cost2 and cost3 in the figure represent the weights of edges R2-R5 and R1-R4, which are 2 and 3 respectively, and the weight of the remaining links is 1. Although the BGP protocol does not use the weight of the edge as the routing metric, in order to more clearly describe the principle of the present invention, it is assumed that the BPG protocol gives priority to the route with the smallest sum of the cost of the destination prefix, and when the costs are the same, it is preferred according to the BGP routing metric. The cost2 and cost3 in the figure can achieve the same effect by adding corresponding BGP neighbors or implementing routing policies to append AS numbers. The figure identifies the propagation path of R3's LoopBack interface address in the network and the forwarding path of R4 forwarding packets to this address. The figure shows the relevant configurations of R1-R6 using Huawei configuration instructions.

[0076] The following combination Figure 6 To further illustrate the present invention, the present invention provides a local network analysis method based on custom configuration dependencies, comprising the following steps:

[0077] Step 1: Read the attributes to be verified. Figure 6 In the embodiment, the attribute to be verified is Reach(R4, R3, LoopBack, 0), that is, whether the LoopBack interface from R4 to R3 is reachable when there is no link failure.

[0078] Step 2: Write a grammar file corresponding to the configuration file, and use ANTLR to compile the grammar file to generate a program that can recognize the configuration text corresponding to the grammar file, and further construct a grammar analysis tree.

[0079] The configuration file is a structured text. By building a syntax analysis tree for the configuration file and traversing the syntax analysis tree, the original configuration can be operated. Figure 7 As shown in the figure, the original configuration uses Huawei's configuration format, which includes configurations for IP addresses, BGP processes, routing policies, etc. Using ANTLR to compile the grammar file corresponding to the configuration file generates a program that can recognize the configuration format and construct the corresponding grammar analysis tree. Due to space limitations, only the grammar analysis tree of the BGP configuration is shown in the figure.

[0080] Step 3: Traverse the parse tree. Using the attributes to be verified obtained in step 1 and the parse tree obtained in step 2 as objects, traverse the parse tree multiple times (breadth-first search) based on the custom dependency relationships to obtain configuration instructions that may affect the routing advertisements and packet forwarding behaviors related to the attributes to be verified.

[0081] Breadth-first search: To obtain all configuration instructions that may affect the attribute to be verified, use Figure 2The process shown is a breadth-first search, and the specific process is as follows:

[0082] In the first iteration, the prefix to be verified is R3's LoopBack interface. Because R3 added the 1:1 community attribute to this prefix, the next iteration searches for a configuration matching the 1:1 community attribute, and this search target is added to the queue. Because R5 configured a static route with the next hop for this prefix set to R2, the next iteration searches for R2, and this search target is added to the queue.

[0083] Second iteration: The goal of this iteration is to retrieve the configuration instructions with a community attribute of 1:1. Since R2 filters the routing advertisements with a community attribute of 1:1, the configuration instructions are recorded and do not need to be queued.

[0084] The third iteration aims to retrieve node R2, record the configuration of node R2 and does not need to be queued.

[0085] End the iteration process.

[0086] Single traversal of the grammar analysis tree: ANTLR provides the listener mode and the visitor mode to implement the traversal of the grammar analysis tree. The listener mode traverses the entire grammar analysis tree, while the visitor mode can selectively traverse the grammar analysis tree according to the target to be retrieved. The visitor mode is used here.

[0087] according to Figure 8 The figure below shows the process of traversing the interface node in the syntax tree. First, the actual prefix object is parsed from the syntax tree context object (line 2). Next, the current target to be retrieved (line 3), the first element in the queue, is obtained. A check is performed to see if the two intersect (line 4), indicating whether a dependency exists. The form of the dependency can be customized here. Finally, the relevant configuration information is recorded (line 5). The dependency relationships and forms can be customized for the remaining nodes in the syntax tree, allowing for a complete retrieval of all relevant configurations.

[0088] Step 4: Use Dijkstra's algorithm and minimum cut algorithm to calculate all network nodes and links that may affect the attribute to be verified in step 1.

[0089] The nodes obtained from step 2 are R2, R3, R4 and R5, using Figure 4 The process shown uses Dijkstra's algorithm to calculate the shortest path between any two nodes, which includes routing propagation and packet forwarding path.

[0090] For this embodiment, the upper bound when calculating any two nodes is 1, bound=1 (line 9);

[0091] R2->R3: The shortest path is R2->R3, which meets the upper bound requirement and exits the loop (line 15);

[0092] R2->R4: The shortest path is R2->R5->R4, which meets the upper bound requirement and exits the loop (line 15);

[0093] R2->R5: The shortest path is R2->R5, which meets the upper bound requirement and exits the loop (line 15);

[0094] R3->R4: The shortest path is R3->R6->R5->R4, which meets the upper bound requirement and exits the loop (line 15);

[0095] R3->R5: The shortest path is R3->R6->R5, which meets the upper bound requirement and exits the loop (line 15);

[0096] R4->R5: The shortest path is R4->R5, which meets the upper bound requirement and exits the loop (line 15);

[0097] Therefore, the link set obtained in this step is R2-R3, R2-R5, R3-R6, R4-R5, R5-R6, and the node set is R2, R3, R4, R5, R5;

[0098] Step 5: Using the network nodes and links obtained in step 4 as objects, retrieve configuration instructions related to the attributes to be verified based on the dependency relationship between configuration instructions, and eliminate irrelevant configurations on the nodes;

[0099] For large networks, switch configurations often contain as many as three to four thousand lines, and the core switch configuration instructions can reach tens of thousands of lines. Most of these are irrelevant to the attributes to be verified. Therefore, by analyzing the calling relationships within the configuration file and extracting relevant configurations, the number of irrelevant variables and constraints created can be reduced. The configuration extraction process of nodes R2 and R6 is used as an example to illustrate how to further calculate relevant configurations.

[0100] The configuration extraction process for node R2. The routing policy test is related to the attribute to be verified. This policy is invoked in the BGP configuration for the neighbor relationships of the adjacent nodes 192.168.12.1, 192.168.23.3, and 192.168.25.5, creating a calling relationship. However, node R1, corresponding to 192.168.12.1, is unrelated to the attribute to be verified. Therefore, all configuration related to this node, such as interface configuration and neighbor relationship configuration, is irrelevant.

[0101] In the configuration of neighbor 192.168.23.3, the neighbor's IP address 192.168.23.3 and R2's interface IP address 192.168.23.2 are in the same subnet. Therefore, the configuration of R2's interface GibabitEthernet0 / 1 is also a related configuration. In this way, the dependency chain is continuously searched for related configurations based on the dependency relationship until no new dependency relationship is found.

[0102] The configuration extraction process for node R6. After the configuration of node R5's GibabitEthernet 1 / 0 is extracted, node R6's GibabitEthernet 0 / 1 is located in the same subnet as R5 and is therefore also considered a related configuration. The neighbor relationship configuration in node R6's BGP configuration is also considered a related configuration and is retained.

[0103] This approach allows you to retrieve all configurations related to the attribute being verified along the custom dependency chain, avoiding analysis of irrelevant configurations, such as the BGP neighbor configuration between R2 and R1, or irrelevant routing prefixes in R3. In the figure, black configurations represent relevant configurations to be analyzed, while gray configurations represent irrelevant configurations.

[0104] Step 6: Using the network nodes, links, and configuration instructions obtained in step 5 as objects, delete the nodes with a degree of 2 in the graph to further reduce the network size.

[0105] After all relevant configurations are retrieved, for nodes with degree 2 in the local network, the failure of any adjacent link will result in no messages passing through the node. For example, the failure of the R5-R6 link will cause the route advertised by R3 to R6 to lose its effect because R6 cannot further propagate the route. That is, the failure of the R5-R6 link and / or the R3-R6 link has the same impact on the attribute to be verified. Therefore, the nodes with degree 2 can be equivalently deleted.

[0106] Equivalent deletion means that after deleting the corresponding node, the configuration of the adjacent node is updated at the same time. For example, the configuration of R3 and R6 is updated to establish a neighbor relationship between the two. R3 adds a routing policy to the route advertised by R6, so that the AS number 6 is appended to the route. For the case where the corresponding routing policy is configured, for example, R6 configures the corresponding route filtering policy, the inbound policy of R3 can be updated to achieve the same filtering effect.

[0107] The present invention also provides a computer network configuration formal verification system, which is used for the above-mentioned computer network configuration formal verification method, comprising:

[0108] The data processing module is used to read the attributes to be verified, including the attribute type, source node, destination node, and link tolerance value, and use ANTLR to write a configuration grammar file that complies with the manufacturer's specifications to construct a configuration file grammar analysis tree;

[0109] A parse tree traversal module is used to take the read attributes to be verified and the constructed parse tree as objects, traverse the parse tree multiple times according to the custom dependency relationship, and obtain configuration instructions that affect the routing announcement and packet forwarding behavior related to the attributes to be verified;

[0110] The data calculation module is used to obtain the nodes of the configuration instructions as the source node and the destination node, and use the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attributes to be verified;

[0111] A data retrieval module is used to retrieve configuration instructions related to the attribute to be verified based on the dependency relationship between the configuration instructions, taking the obtained network nodes and links as objects;

[0112] The data deletion module is used to take the obtained network nodes, links, and configuration instructions as objects, and to equivalently delete the nodes that will have no messages if any adjacent link fails, thereby completing the formal verification of the computer network configuration.

[0113] In summary, the present invention provides a method and system for formal verification of computer network configurations, which continuously retrieves configuration instructions related to the attributes to be verified, and equivalently deletes irrelevant configurations, which can greatly reduce the number of variables and constraints created, greatly reduce the scale of network analysis, and improve the scalability of verification tools without losing the attribute verification capability of the verification tools, without limiting the application scenarios of the verification tools, and can select appropriate verification tools for verification as needed. For example, for situations where local network links are dense, an SMT-based method can be used for verification to avoid enumerating all link state spaces; for situations where the number of nodes is large, a simulation-based method can be used for verification to obtain higher verification fidelity.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A method for formal verification of computer network configuration, characterized in that: The steps include: Step 1: Read the attributes to be verified, including the attribute type, source node, destination node, and link tolerance value, and use ANTLR to write a configuration grammar file that complies with the manufacturer's specifications to construct a configuration file grammar analysis tree; Step 2: Taking the read attribute to be verified and the constructed parse tree as objects, traverse the parse tree multiple times according to the custom dependency relationship to obtain configuration instructions that affect the routing advertisement and packet forwarding behavior related to the attribute to be verified; Step 3: Using the nodes of the obtained configuration instructions as the source node and the destination node, use the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attribute to be verified; Step 4: Taking the obtained network nodes and links as objects, retrieve the configuration instructions related to the attribute to be verified according to the dependency relationship between the configuration instructions; In step 5, the obtained network nodes, links, and configuration instructions are used as objects, and the nodes that will have no messages if any adjacent link fails are equivalently deleted, thus completing the formal verification of the computer network configuration.

2. A method for formal verification of computer network configuration according to claim 1, characterized in that: In step 1, the construction process of the grammar analysis tree is to write a configuration grammar file, then use ANTLR to compile the grammar file to generate a program that recognizes a specific configuration format, and finally use the listener mode or visitor mode provided by ANTLR to traverse the grammar analysis tree corresponding to the configuration file; The listener mode traverses the entire grammar analysis tree, while the visitor mode traverses the grammar analysis tree selectively according to the target to be retrieved.

3. A method for formal verification of computer network configuration according to claim 1, characterized in that: In step 2, the process of traversing the syntax analysis tree is to check whether the configuration instructions intersect with the attributes to be verified. The object to be checked in the next iteration is determined based on the behavior of the routing policy. The specific process is as follows: Step 21: Initialize a queue based on the destination prefix of the attribute to be verified. Step 22, traverse the syntax analysis tree according to the first element of the queue to retrieve the relevant configuration; Step 23: Update the queue according to the configured routing policy, and stop traversing until the queue is empty.

4. A method for formal verification of computer network configuration according to claim 1, characterized in that: In step 2, the syntax analysis tree is traversed multiple times according to the custom dependency relationship, and a breadth-first search is used to obtain all configuration instructions that may affect the attribute to be verified.

5. A method for formal verification of computer network configuration according to claim 1, characterized in that: In step 2, ANTLR provides the listener pattern and the visitor pattern to implement the traversal of the grammar analysis tree, where the listener pattern traverses the entire grammar analysis tree, while the visitor pattern selectively traverses the grammar analysis tree according to the target to be retrieved.

6. A method for formal verification of computer network configuration according to claim 5, characterized in that: The process of traversing the syntax analysis tree is as follows: Parse the real prefix object from the context object of the syntax tree, then obtain the current target to be retrieved, where the current target to be retrieved is the first element in the queue, and determine whether the two intersect to determine whether there is a dependency relationship. The form of the dependency relationship is customized, and finally record the relevant configuration information; The remaining nodes in the syntax tree customize the dependency relationships and dependency forms, allowing for complete retrieval of all related configurations.

7. A method for formal verification of computer network configuration according to claim 1, characterized in that: In step 3, the specific process of using the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attribute to be verified is as follows: First, initialize the link set allEdges to empty and calculate the relevant links between any two nodes. The upper bound of the link tolerance value when calculating the relevant links is the smaller of the user-specified max_failure+1 and the minimum cut between the two nodes. If the calculated minimum cut of the local network edge_graph does not reach the upper bound, the cut edge is deleted, the shortest path is recalculated, and it is added to the relevant link edges. Finally, all the relevant nodes and links are obtained.

8. A method for formal verification of computer network configuration according to claim 1, characterized in that: In step 4, configuration instructions related to the attribute to be verified are retrieved based on the dependency relationship between configuration instructions. Specifically, the relevant interface configuration, protocol configuration, and policy configuration are retrieved in sequence based on the calling relationship and potential dependency relationship within the configuration file, and configurations that are not related to the attribute to be verified are deleted.

9. A method for formal verification of computer network configuration according to claim 1, characterized in that: In step 5, the specific process of equivalently deleting nodes that will have no messages if any adjacent link fails, using the obtained network nodes, links, and configuration instructions as objects, is as follows: First, all nodes are traversed, excluding the source node and the destination node. If a node is a node where any adjacent link failure will result in no message, the node is deleted and the configuration of the adjacent nodes is updated.

10. A computer network configuration formal verification system, used for the computer network configuration formal verification method according to any one of claims 1 to 9, characterized in that: include: The data processing module is used to read the attributes to be verified, including the attribute type, source node, destination node, and link tolerance value, and use ANTLR to write a configuration grammar file that complies with the manufacturer's specifications to construct a configuration file grammar analysis tree; A parse tree traversal module is used to take the read attributes to be verified and the constructed parse tree as objects, traverse the parse tree multiple times according to the custom dependency relationship, and obtain configuration instructions that affect the routing announcement and packet forwarding behavior related to the attributes to be verified; A data calculation module is used to use the nodes of the obtained configuration instructions as source nodes and destination nodes, and use the Dijkstra algorithm and the minimum cut algorithm to obtain all network nodes and links that affect the attribute to be verified; A data retrieval module is used to retrieve configuration instructions related to the attribute to be verified based on the dependency relationship between the configuration instructions, taking the obtained network nodes and links as objects; The data deletion module is used to take the obtained network nodes, links, and configuration instructions as objects, and to equivalently delete the nodes that will have no messages if any adjacent link fails, thereby completing the formal verification of the computer network configuration.

Images